1. Overview of Zero-Knowledge Systems Inc
Overview of Zero-Knowledge Systems Inc. and the Private Credentials Technology
December 5th 2000
Eric Bergeron
General Manager – Wireless Solutions
All information contained within is CONFIDENTIAL AND PROPRIETARY INFORMATION
© Zero Knowledge Systems Inc, November 18, Montreal, Canada. All rights reserved.

2. Privacy – What is it? Information self-determination
The claim of individuals, groups or institutions to determine for themselves when, how, and to what extent information about them is communicated to others
Personally Identifiable Information (PII) is any information which can be used to identify a specific individual
Not just name, address, SSN/SIN
Data elements such as date of birth + zip code, or transactional history can narrow the focus down to a small enough group of people to be considered PII
In an increasingly networked world, the privacy issue is becoming more and more important
Ease and speed of information capture, storage and dissemination
Online/offline profile matching
Cross-site tracking using cookies, web bugs, etc.
Internet connected appliances
Wireless location-based tracking

3. OECD 8 Principles of Fair Information Practice
Defining Privacy vs. Security
OECD 8 Principles of Fair Information Practice
Collection Limitation
Data Quality
Purpose Specification
Use Limitation
Openness
Individual Participation
Accountability
5. Security safeguards
Security is a sub-set of privacy. You can address all of your security concerns without addressing privacy.

4. Zero-Knowledge Private Credentials

5. Digital Certificates
Sequences of zeros and ones (of a mathematical structure)
Verifiable with 100 % accuracy by computers
Transferable electronically (no human intervention, fast)
Unforgeable (crypto protection)
Can specify any kind of data

7. Drawbacks to organizations
Transaction delays
Lost business (faulty/ irrelevant data, online connection fails)
Central database verification
Hard to protect databases against hackers and insiders
Privacy standards bring compliance costs
Manage CRLs / online validation

8. Privacy Concerns
Traceability (CA, verifiers, wiretappers, intel. agencies)
Discrimination (consults any database)
No control over secondary use
Revocation (CRL, online whitelists)

9. Private Credentials
Similar to coins and public transport tickets (not identifiable)
Encode attributes in the private key
Selectively disclose the attributes
Practical
Security benefits

11. Selective Disclosure
Show part of attribute data without revealing more (think: marker)
More powerful than paper-based certificates (Boolean properties, n out of m, intervals)
Works across different Private Credentials

12. Fraud Protections Reduce identity fraud
Eliminate central database risks
Discourage lending (encode secret of user)
Discourage discarding (tie unfavorable attributes in)
Limited-show property (identity computable if shown too often)

14. Private Payment (E-Cash)
Special case of private credential
System prototype is working today
An attribute contains information about a currency (issuer, denomination, etc.).
Always Revealed in the showing protocol
An attribute contains personal information for “off-line fraud tracing”.
Never revealed in the showing protocol
The payment is the transcript of a showing protocol

15. Sample Applications Prepaid for Mobile Phones
Private Payment (e-cash) for ME-Commerce
ID cards (with privacy)
Road-toll and public transport pricing/ticketing
Digital copyright protection (certificates permit use of works)
Access control (VPNs, subscription services, Web sites, databases)
Medical prescriptions / medical files
Electronic voting
Online auctions
Financial securities trading
Electronic gambling
Loyalty schemes

16. Smartcard Implementation
Strong protection against loss, theft, extortion, lending,copying, discarding, etc.
Uses mathematical primitives which are present in crypto enabled smartcards.
Can be used in conjunction with desktop computer, PDA, etc. in which case we can use standard 8-bit smartcards.